Trade without a trail

A public wallet is a public portfolio

Tokenized stocks put shares of Nvidia, Apple or the S&P 500 fund on a public chain. That brings real advantages: they trade at any hour, settle in seconds, and sit in a wallet you control. It also brings a cost that a brokerage account never had. Every position, every trade and every transfer is recorded under one address that anyone can read.

Once someone links that address to you, through a payment, a post, an exchange withdrawal or a single careless transfer, they can see what you own, what you paid, when you sell and how much you keep. The record is permanent. Nobody would accept a brokerage that published its clients' statements, yet that is the default on chain.

Ghostdex starts from that problem. It keeps everything that makes tokenized stocks useful and changes one thing: the trade does not have to happen under your address.

Ghosts

A ghost is an ordinary address with no past. Your wallet signs one fixed message, once. Ghostdex hashes that signature into a root, and ghost number i is the key derived from the root and i. All of this happens in your browser. The signature is not a transaction and costs nothing, and neither it nor any key is sent to a server.

root      = keccak256(signature of the Ghostdex message)
key(i)    = keccak256(root ‖ uint256(i))
ghost i   = the address of key(i)

Most wallets sign deterministically, so the same wallet signing the same message on another device produces the same root and the same ghosts. For wallets that do not, Ghostdex detects the difference and offers a backup key, the root itself, that restores every ghost anywhere. Ghosts are free to create, and nothing exists on chain until one is funded.

In the app, a menu at the top says who you are acting as. Pick a ghost and every swap, basket, deposit, loan and launch is signed by that ghost, with its own confirmation sheet. Your main wallet stays out of the transaction. Someone who looks up the ghost sees its own trades, not your history.

Around the ghosts, ghost mode blurs balances and addresses on screen until you point at them, and sends the page's chain reads and the ghosts' transactions through the Ghostdex relay, so that nodes see our server instead of your IP address. The relay forwards requests and keeps nothing. The site runs no analytics and sets no tracking cookies.

Funding and leaving

A ghost is only as separate as the way money reaches it. If you send funds straight from your main wallet, the explorer shows the link forever. The most private way in leaves your wallet out entirely: a ghost's key works on every EVM chain, so an exchange can withdraw straight to the ghost's address on Base, and the ghost then bridges what arrived to itself on Robinhood Chain. Funding from another chain with your own wallet keeps you off this chain's explorer, but the bridge record names your wallet. Before any bridge is signed, the app checks that the route really delivers to the ghost.

Leaving follows the same logic. A ghost can send to another ghost, to another chain through a bridge, to any address, or back to your main wallet. The last option draws the line between you and the ghost again, so the app warns before it and marks the ghost as linked. The direct funding path carries the same warning.

None of this hides amounts or timing. A deposit and a ghost funded with the same amount minutes apart can be matched, and bridges can know both ends of the routes they carry. The habits that help are simple: fund from another chain, vary amounts and timing, and do not sweep straight home.

Habits are easier to keep when you can see where they failed. Trace check reads every transfer your ghosts made, your main wallet's USDG and WETH transfers, and LI.FI's public history of the bridge routes your wallet paid for, then works out in your tab every line someone could draw: money that moved between a ghost and your wallet, a bridge record naming both, a deposit address you share, amounts and times that match, and ghosts tied to each other, so that a line to one carries over to the other. It reports what it found and what it cannot see, such as plain ETH moved from another device. It hides nothing; it shows what public data already shows.

Paying and getting paid

Money also moves between people, and an address handed to one person tells them everything else that address does. Ghostdex has a way for each direction. A link sends a stock, USDG or ETH as a URL: a one-time address that holds the asset and the gas to move it, with its key after the #, so whoever opens it claims it without ETH and the sender can take it back until then. A ghost card receives: one link made of two public keys, and every payment to it lands on a new address that only the card's owner can find and spend, which then works as a ghost. The card uses ERC-5564 stealth addresses on the Announcer contract that already runs on Robinhood Chain. A request adds an amount and a note to the card's link, after the #, and the payment that answers it carries the request's number sealed with that payment's own secret, so only the owner can match the two. Ghost Pay keeps the cards of the people you pay as contacts, in your browser, and pays them from a ghost in a few taps, with a history no server holds.

Neither hides the payer, the amount or the timing. A link is cash: whoever holds it can claim it. A payment to a card stays apart from the others only while its owner keeps it apart.

A pool with a proof

A ghost breaks the explorer link only if the money that funds it does not draw a new one. Ghost Pool is the way in from your own wallet. You deposit USDG or ETH into a contract, where it becomes a private note: a Poseidon commitment to the amount, your key and a random value, sealed to your key so your tab finds it again on any device. To take it out, your tab makes a Groth16 proof over a join-split circuit (two notes in, two out, the Tornado Nova design): the notes are in the pool's Merkle tree, they are yours, they were never spent, and the amounts balance. The proof says none of which notes, whose, or how much. A relayer sends the withdrawal and pays its gas, so the ghost needs nothing to start with, and the proof fixes its recipient and fee. With Shielded Buy, the ghost turns the withdrawal into a stock in the same flow, so it holds shares from its first minute without a line back to the wallet that paid for them. Shielded Sell is the way back: a ghost sells a stock and deposits the USDG in the same flow, so its proceeds can come out later in a ghost with no line to it. Notes can also change hands without leaving the pool: a send to someone's shielded address spends your notes and makes one for them, sealed to their key with an optional message, and the chain sees neither the amount nor the two people. A Shielded Link does the same for someone without an address yet: the note goes to a key carried in the link, and whoever opens it claims the note into their own notes or a ghost.

A proof can hide which deposit paid a ghost; it cannot hide a crowd that is not there. With few deposits, an amount that matches yours, or a withdrawal right after your deposit, the two can still be paired, so the app reads the pool's public deposits before you withdraw and Trace check reads them after. The contracts have no upgrade path and no way for anyone to move deposits without a proof; the owner can only pause new deposits. The circuit's setup has one contributor in its second phase, which is why deposits are capped at 10,000 USDG or 3 ETH until an open ceremony.

Agents on a leash

Many people would rather describe what they want than place every order themselves. Ghostdex lets them write it down: a mandate in plain words, the stocks the agent may touch, the largest single order, a budget, an end date, an optional schedule, and whether it may sign on its own.

The design rests on one decision. Each agent gets a dedicated ghost, and you fund that ghost with the budget. The agent can trade only from it, so the worst case is fixed before it starts: it can lose, at most, what its ghost holds. It never sees your main wallet or your other ghosts.

The agent thinks with Claude, Anthropic's model, on the Ghostdex server. The server receives the mandate, the ghost's balances and your instruction, adds current prices from the chain's pools, and returns a plan: a short note and a few orders. It never receives a key and sends nothing. Your browser then checks every order again (an allowed ticker, the per-order cap, enough cash, sells no larger than holdings, a small ETH reserve for gas) and signs as the agent's ghost through LI.FI routes.

With autopilot off, every transaction shows a confirmation sheet. With autopilot on, only the agent's own ghost signs without one, and every other address still asks. Scheduled checks run only while a Ghostdex tab is open on your device. Agent runs come with a free daily allowance per connection, and a preview shows what an agent would do with $500 before anyone signs anything.

The exchange underneath

Under the ghosts and agents, Ghostdex is a complete exchange for the 95 stock tokens it lists on Robinhood Chain (chain id 4663, gas paid in ETH). Single swaps and bridges are quoted through LI.FI, which compares the pools and aggregators on the chain and the bridges that reach it. Each quote arrives with a minimum that the contract enforces: if the market moves past your slippage setting, the transaction reverts and only gas is spent.

Baskets buy several stocks at stated weights in one Universal Router transaction. Each leg is quoted against the best Uniswap pool for that stock and carries its own minimum, so an order never leaves you with two stocks out of three. A three-stock basket measured about 427,000 gas paid in USDG.

Idle USDG can earn in Morpho vaults, and Morpho Blue markets accept stock tokens as collateral for USDG loans. The launchpad creates a token, its bonding curve and its pool in one transaction through Doppler, paired with ETH, USDG or a stock. Doppler's hook keeps 5% of each trading fee; the rest goes 70% to the creator, as payouts or as buybacks of their own token, and 30% to the Ghostdex treasury.

All of it works from your main wallet or from a ghost. A self-custody wallet is built into the site for phones and browsers without an extension: a standard recovery phrase, encrypted with your passcode through PBKDF2 (600,000 iterations) and AES-GCM, that locks itself when idle.

What Ghostdex does not do

• It does not hold your funds. There are no accounts and no balance with us; Ghost Pool deposits sit in a contract that pays them only against their owner's proof. Every other order is a transaction signed by your wallet or one of your ghosts.
• Apart from Ghost Pool, it deploys no contracts of its own. Every other order calls contracts already on the chain: Uniswap, LI.FI, Morpho and Doppler.
• It does not see your keys. Ghost keys, including those of agents, and the built-in wallet live in your browser.
• A ghost breaks the explorer link between your wallet and a trade; it does not hide amounts, timing or the trade itself. Ghost Pool keeps deposits together in a contract that pays each one out only against its owner's proof; it hides which deposit paid a ghost, not a pool too small to hide in.
• It cannot reverse a transaction. Once a key signs and the chain includes it, it is final.

These are choices, and they cut both ways. There is nothing for Ghostdex to freeze, lend out or lose, and nothing to trust beyond the contracts named in the documentation. There is also nobody who can undo a mistake.

$GHOSTDEX

$GHOSTDEX is the token of Ghostdex, launched on Pons. It has two links to the product. Holders of at least 100,000 get a larger daily allowance of agent runs, ten times the free one. And the treasury's share of launchpad fees, 30% after Doppler's cut, is used to buy $GHOSTDEX back in its pool and send it to the dead address, in public transactions anyone can check.

It is worth saying what the token is not. It is not a share in Ghostdex and gives no claim on its treasury or income. It pays no dividend and gives no vote. It is not needed to use ghosts, ghost mode, the exchange, or agents within the free allowance. Buybacks depend on how much the launchpad is used, which can be a lot, a little or nothing.

Risks

• Privacy limits: ghosts do not hide amounts, timing or the trades themselves. A direct transfer or a sweep home links addresses, and bridges can know both ends of a route.
• Keys in the browser: ghost keys and an unlocked wallet live in your tab. Malware on your device, or a leaked backup key, can take them.
• Agents: plans come from an AI model that can be wrong. On autopilot, the agent's ghost signs without asking; its loss is bounded by what that ghost holds.
• Contracts: every venue Ghostdex calls can contain a bug or be exploited. Ghostdex wrote none of them.
• The issuer: stock tokens can be paused, addresses can be blocked, and corporate actions apply through a display multiplier. Orders that touch a paused token revert.
• Markets: thin pools move more for the same order; outside US hours, prices drift and spreads widen.
• Lending and bridges: loans against stocks can be liquidated, vault withdrawals depend on unlent liquidity, and bridges can be delayed or refund.
• Launched tokens: anyone can launch one, and it can lose all its value.
• Eligibility: tokenized stocks are not offered to US persons, and each issuer sets its own rules.

Nothing in this document or on the site is investment, legal or tax advice. The documentation describes each operation, its costs and its risks in more detail.